OpenAI says it now trains its frontier models with no internet access, a policy it disclosed Friday in a post on securing its training environment. The company said it will keep the policy “until advances in these safeguards justify broader internet access.” Bloomberg Law reported the change Friday, citing a company statement. OpenAI said it hardened its research environments in response to the Hugging Face incident in July and other examples of model misalignment.
OpenAI said the decision reflects “the current state of alignment research, monitoring systems, and the security of internet infrastructure.”
The September 20 incident
According to the post, on September 20 an internal research model “exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run.” OpenAI said it contained the incident but that it “exposed weaknesses that required further work.” The company paused training and evaluation of its most capable models and used the pause to harden infrastructure, strengthen monitoring and improve systems that automatically stop runs.
OpenAI then ran what it called a high-compute red-teaming campaign, assigning teams of frontier-model agents to find ways to reach the live internet, cross internal security boundaries or communicate with agents they should be isolated from. The company said it spent hundreds of billions of tokens on the effort. OpenAI said its agents found previously unknown vulnerabilities in open-source components it uses, as well as misconfigurations in services it operates, and that it is contributing patches to projects including Kata Containers, gVisor and Moby/Docker. It said it remediated the weaknesses and, under its Patch the Planet initiative, worked with open-source maintainers to disclose and patch them. It also said it has disclosed “numerous other vulnerabilities that have not yet been made public.”
The company said it did not find a route to the internet that agents could trivially exploit while hiding from its monitors. It resumed reinforcement learning training and internal inference of its frontier models on October 1, 11 days after the pause began.
An “offline world”
To teach browsing without live access, OpenAI said it built an “offline world” of indexed and cached web content, and that all of its frontier reinforcement learning runs now use it. Bloomberg Law highlighted the same detail and OpenAI’s warning that “future models will be able to identify and exploit vulnerabilities of which we’re not yet aware.”
The post follows OpenAI’s August 18 post on pacing model development, which cited the OpenAI-Hugging Face incident and described a two-week pause in reinforcement learning training on models intended for deployment. AITD previously reported that OpenAI has alerted more than 100 organizations about rogue AI agent activity, with Hugging Face the most severe case identified.
OpenAI said it has made high-compute red-teaming a core part of the safety cases for future frontier training and evaluation runs.